CVE-2026-9226: Devolutions Server Auth Bypass Vulnerability

CVE-2026-9226 Overview

CVE-2026-9226 is an authentication bypass vulnerability in the Azure Active Directory (Azure AD) external login flow of Devolutions Server. The flaw affects Devolutions Server version 2026.3.7.0 and earlier. A remote attacker can take over a user's account by replaying a captured login-session token that is exposed in a redirect URL. The weakness is classified as [CWE-294] Authentication Bypass by Capture-replay. Because the token travels through a URL rather than a protected channel, interception enables account takeover without credential theft.

Critical Impact
An attacker who captures the session token from the Azure AD redirect URL can replay it to assume the identity of the targeted user and gain unauthorized access to Devolutions Server resources.

Affected Products

Devolutions Server 2026.3.7.0 and earlier
Deployments using the Azure AD external login flow
Any Devolutions Server tenant relying on the vulnerable federated authentication path

Discovery Timeline

2026-10-06 - CVE-2026-9226 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database
Advisory - Published by Devolutions as Devolutions Security Advisory DEVO-2026-0035

Technical Details for CVE-2026-9226

Vulnerability Analysis

The vulnerability resides in the Azure AD external login flow implemented by Devolutions Server. During federated authentication, the server receives a session token through a redirect URL. The token is not bound to a single-use nonce or additional transport protections, which allows capture and replay. An attacker who obtains the URL from browser history, proxy logs, referer headers, or intermediate network devices can submit the same token to the server. The server accepts the replayed token and establishes an authenticated session for the attacker as the victim user.

Root Cause

The root cause is improper handling of authentication material in the OAuth or OpenID Connect redirect handler. Session tokens placed in URL query parameters are frequently logged by web servers, proxies, and browser history stores. The absence of replay protection, such as single-use nonces, short expiration windows, or binding to client state, allows the same token to authenticate multiple times.

Attack Vector

Exploitation requires an attacker to obtain a victim's Azure AD redirect URL containing the login-session token. Capture paths include compromised reverse proxies, server access logs, shared workstation history, HTTP referer leakage, and network observation when TLS is terminated upstream. Once captured, the attacker submits the token to the Devolutions Server authentication endpoint. The server validates the token and issues a session that impersonates the victim account. No credentials, multi-factor prompts, or additional user interaction are required.

See the Devolutions Security Advisory DEVO-2026-0035 for vendor-provided technical context.

Detection Methods for CVE-2026-9226

Indicators of Compromise

Repeated authentication events using the same Azure AD session token value from different source IP addresses or user agents.
Successful logins to Devolutions Server from geolocations or networks that do not match the user's baseline.
Session establishment immediately following access to the Azure AD redirect endpoint from an unexpected client.
Access log entries containing session token values in URL query strings for the Azure AD callback path.

Detection Strategies

Correlate Devolutions Server authentication events with Azure AD sign-in logs and alert on mismatches between the Azure AD session and the client that completed the Devolutions login.
Hunt for duplicate token identifiers appearing across distinct sessions within a short window.
Flag authentication activity in which the HTTP referer, user agent, or source network changes between the Azure AD redirect and the Devolutions session issuance.

Monitoring Recommendations

Forward Devolutions Server authentication logs and Azure AD sign-in logs to a centralized analytics platform for correlation.
Monitor reverse proxy and web server access logs for retention of URLs containing authentication tokens and remediate log exposure.
Alert on anomalous session reuse, concurrent sessions for the same account, and sudden privilege-sensitive actions following federated login.

How to Mitigate CVE-2026-9226

Immediate Actions Required

Upgrade Devolutions Server to a release later than 2026.3.7.0 that contains the fix referenced in advisory DEVO-2026-0035.
Invalidate all active Devolutions Server sessions and require users to re-authenticate through Azure AD after patching.
Rotate any secrets or credentials accessed through Devolutions Server if account takeover is suspected.
Review authentication and audit logs for signs of replayed tokens or unexpected session activity.

Patch Information

Devolutions has published remediation guidance in Devolutions Security Advisory DEVO-2026-0035. Administrators should apply the vendor-supplied update to a version newer than 2026.3.7.0. Validate the upgrade in a staging environment and confirm that the Azure AD external login flow no longer exposes session tokens in redirect URLs.

Workarounds

Restrict Devolutions Server access to trusted networks or require VPN connectivity until the patch is applied.
Disable the Azure AD external login flow and rely on an alternative authentication method where feasible.
Enforce short session lifetimes and require re-authentication for sensitive operations to limit the window of replay.
Purge historical web server, proxy, and browser logs that may contain captured session tokens.

bash

# Configuration example
# Review Devolutions Server version and confirm it exceeds the vulnerable release
# Then invalidate existing sessions after upgrade
# Replace <server> with your Devolutions Server host
curl -s https://<server>/api/version
# Expected: a build later than 2026.3.7.0